Job scam in India: what it is and how the fraud runs

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Online fraud

The phone rings, or a message arrives on WhatsApp: a company you have heard of is hiring, the work is simple, the salary is good, and the only step left is a small payment — a registration fee, a security deposit, a training charge, or a "refundable" amount. That is a job scam. The offer of employment is the bait, the payment is the purpose, and the company is either invented or impersonated. The victim is not careless; the scam is built to look ordinary because it imitates the ordinary mechanics of hiring.

Understanding how it runs is the defence. A job scam is not a single trick but a sequence — contact, credibility, small payment, bigger payment, extraction — and it is designed so that each step feels like progress. Once you can see the sequence, you can see the point at which to stop and report.

What the law says

There is no single "job scam" offence; the conduct is prosecuted under general criminal law applied to a digital setting. The Information Technology Act, 2000 supplies the digital limb. Section 66C punish identity theft when the scammer impersonates a real company or a real recruiter, clones a staff profile, or uses a genuine firm's logo on a fake website. Section 66D punishes cheating by personation using a computer resource or communication device — the provision most job scam complaints attract, because the fraud is carried out by a person pretending to be someone else through a phone or a website. Section 66 covers unauthorised access to a computer resource, relevant where the scam involved phishing credentials or taking control of an account.

The Bharatiya Nyaya Sanhita, 2023 covers the underlying conduct. Section 318 punishes cheating, and section 318(4) covers cheating and dishonestly inducing delivery of property — the heart of a fee-fraud. Section 316 covers criminal breach of trust where money was entrusted and then misappropriated. Section 336 punishes forgery, which is the charge for fake offer letters, forged appointment letters and fabricated company letters bearing a real firm's name. Section 61 covers criminal conspiracy and lets the police charge the whole operation — the caller, the "HR manager", the account holder who receives the fee.

Where the recruiter harvests your documents — Aadhaar, PAN, marksheets, bank details — the identity theft limb of section 66C is directly engaged, and the DPDP Act, 2023 frames your rights over the personal data collected. Where the fraud ran through a large platform or an app store listing, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require the intermediary to act on a grievance and remove unlawful content within the timelines those rules prescribe, which is a separate way to stop the next victim. On the money side, the RBI circular of 2017 on limiting liability in unauthorised electronic banking transactions governs how much of a loss your bank must absorb if the payment left your account by fraud, and it fixes the reporting window that caps your liability.

How the fraud actually runs

Most job scams follow a recognisable arc. Not every scam uses every step, but the shape recurs.

1. Contact. You are approached by an unsolicited message, a call, a social media post or a listing on a jobs site. The offer arrives without you applying, or you applied for something entirely different.
2. Credibility building. The scammer impersonates a real company, sends an official-looking email from a lookalike domain, shares a fake ID card, or runs a polished website and a WhatsApp group full of "employees".
3. The small ask. A modest registration or processing fee is requested — small enough to seem routine. Sometimes it is framed as refundable, sometimes as a background verification charge.
4. A real-looking document. A fake offer letter or appointment letter is issued to make the process feel authenticated.
5. The escalating ask. Further charges follow — training, equipment deposit, security deposit, GST or a "release" payment before the first salary.
6. The task-based variant. Instead of an upfront fee, you are given simple tasks — liking videos, rating products, completing surveys — and are paid small amounts to build trust, after which a larger "investment" task is offered, and the withdrawal stops.
7. Disappearance. Once the payments stop coming or you ask for a refund, the contact goes silent, the number is changed, the group is closed, and the website goes down.

The task-based variant deserves attention because it looks less like a fee and more like a job. The victim is paid, briefly, and the money that builds trust is the money that later makes the larger loss feel voluntary. Legally it is the same fraud: a false representation of employment inducing a payment.

The scam stages at a glance

What decides the outcome

When a job scam complaint is tested, a few facts carry the case. First, the inducement: can you show the specific promise of employment and the misrepresentation behind it? A chat saying "pay this fee and join" is the core exhibit. Second, the money trail: the beneficiary account, the UPI or NEFT reference, and the identity of the recipient, even if it is a mule account. Third, the impersonation: proof that the scammer used a real company's name, logo or certificate without authority, which supports IT Act sections 66C and 66D and BNS section 336. Fourth, the speed of reporting, which governs both the chance of a freeze under the RBI 2017 framework and the cap on your bank liability.

Some questions remain genuinely unsettled. Whether a foreign-listed "employer" or an offshore platform is within reach of an Indian investigation depends on the facts and on international cooperation, and no honest adviser will promise a recovery there. The offence may be clear while the enforcement is slow.

Common mistakes by victims and by investigators

• Paying a "refundable" fee to verify the job. A genuine employer does not charge you to be hired.
• Trusting an offer letter without verifying it against the company's own official website or HR contact, found independently rather than through the sender's link.
• Sharing Aadhaar, PAN or bank details before verifying the employer, which turns a fee fraud into an identity theft risk.
• Reporting only to the company being impersonated and not to the police, so no FIR captures the trail.
• Continuing to interact with the scammer to "negotiate" a refund, which usually produces a second payment, not a refund.
• Assuming that because the amount is small, it is not worth reporting. Small amounts aggregate into a pattern that supports a conspiracy charge.

No legitimate employer collects money from the person it is hiring. That single rule defeats most job scams at step three.

Reporting and moving on

If you are caught, call 1930 or file at cybercrime.gov.in immediately and notify your bank the same day, then lodge a written police complaint at the station where the payment originated. Under BNSS 2023 section 173 the information must be recorded, and a Zero FIR can be registered where the offence crosses districts. If the police do not act, an application under BNSS 2023 section 175(3) lies to the jurisdictional magistrate. Because job scams are run from anywhere, the local cyber cell in West Bengal and a cyber crime lawyer in Kolkata can push both the police and the bank, and preserve the evidence properly under BSA 2023 section 63. Where an accused is later arrested, the complainant's documented trail is what supports opposing bail.

Who is actually behind the offer

The name on the offer letter is almost never the name of the person running the scam. It is either a real company whose identity has been borrowed, or a shell with a website built in a week. The website copies the branding, the address and sometimes the careers page of a genuine employer. The email domain differs by a letter. The phone number is a virtual number that forwards to another state or another country. The "HR manager" is a person who is paid to answer calls and send documents, and who may not know the whole operation.

That structure is why the first question in any investigation is not "who took the money" but "whose identity was used and whose account received it". The identity answers the IT Act charge under section 66C, and the account answers the money trail. Where the company is real and its name was misused, the company itself is a witness and often a complainant, because its reputation has been stolen. Its own records can establish that the offer letter, the email domain and the recruiter never belonged to it.

Red flags that separate a job scam from a real offer

• A fee at any stage before employment: registration, training, laptop deposit, visa processing, or a "refundable" security amount.
• An offer made entirely over WhatsApp or Telegram, with no interview on a verifiable company channel.
• An email domain that imitates the company but is not the company's domain.
• Payment requested to a personal account, a UPI ID or an account in a name different from the employer's.
• Pressure to decide within hours, and a refusal to put the terms in a formal appointment letter.
• A "task" or "prepaid" model where you are paid small amounts to complete reviews or bookings and then asked to deposit more to unlock earnings.
• Recruitment through a group where other "candidates" post screenshots of payouts. Those posts are usually from the same operation.

None of these is conclusive on its own. What distinguishes the scam is the combination: the payment comes before the job, it goes to an individual rather than a company, and the process is designed to prevent you from verifying anything independently.

Why the fraud is hard to stop once it starts

Two features make job scams efficient. The first is the small first payment. A registration fee of a few thousand rupees feels affordable against a promised salary, so the victim pays without checking. The second is the escalation. Once the first payment is made, the operation offers a reason to pay again: a training module, a document fee, a deposit that will be refunded with the first salary. Each payment is justified by the last, and the victim keeps going because stopping means accepting that the earlier money is gone.

By the time the victim reports, the receiving accounts have usually been abandoned and the money moved. That is why the complaint should not wait until the whole picture is clear. The report on 1930 and the bank intimation should go out as soon as the first suspicious demand appears, even before the victim is certain, because the freeze window closes whether or not the victim has made up their mind.

When to involve a lawyer

Report the scam yourself; it is fast and free. Bring in counsel when the police decline to register the complaint, when the bank rejects the liability claim, when your documents were used for further fraud, or when the amount and the pattern justify a recovery suit and a coordinated complaint. A lawyer's value here is mostly organisational — one chronology, one evidence set, all remedies running together.

The point of understanding how the fraud runs is not to blame yourself for being fooled. It is to recognise step three before it becomes step six, and to know that the law treats this as crime, not as a bad bargain.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Work From Home Scam: What It Is and How It Runs
• Trading app scam: what it is and how the fraud runs
• Stock market scam: how the fraud actually runs in India
• Mutual fund scam: what it is and how the fraud runs
• Investment scam: what it is and how it works in India
• Sextortion: What It Is and How the Fraud Actually Runs

Cyber crime lawyer in your city · Bank account freeze help · Contact